Professional Documents
Culture Documents
Control
Control
This handbook provides machine designers, quality assurance managers, sales directors
and others with a road map for understanding the Machinery Directive and CE marking Machinery Directive
process. Its contents include:
• An easy-to-follow introduction to the Machinery Directive and key European Norms
(standards)
• The basic CE marking steps
• Direction to further resources A Road Map to CE Marking and Safety-Related
• Important guidance on risk estimation and assessment Control Product Applications
• A review of safety and safety-related components for control systems
• Answers to frequently asked questions
• Excerpts from selected directives and standards
Most importantly, Understanding the Machinery Directive provides some straight
talk about what the language of the directives and standards really requires.
Publication SHB-900 — September 1997 © 1997 Allen-Bradley Company, Inc. Printed in USA
Understanding the
Machinery Directive
A Road Map to CE Marking and Safety-Related
Control Product Applications
Onemli duyuru
This publication contains summary information regarding European Union (EU) directives relevant to
industrial control and automation products of the type manufactured by Rockwell Automation/Allen-Bradley.
This information is solely based on Rockwell Automation’s interpretation of those directives and should not
be considered a definitive analysis of all relevant EU directives or their impact on any one company’s goods
or services. Because of the vast variety of product uses, those responsible for the application and use of those
products within the EU should conduct their own independent evaluation to assure that each application and use
meets the requirements of all relevant directives, as well as other local and regional codes, laws and regulations.
Credits
Rockwell Automation would like to extend special appreciation to the following individuals for sharing
their knowledge of European safety legislation:
John Bloodgood Timothy Panchot
President Sales representative
JFB Enterprises Intertek Testing Services
Fond du Lac, Wisconsin Lake Elmo, Minnesota
Numerous individuals from Rockwell Automation/Allen-Bradley also deserve credit for their contributions
to this handbook:
Kyle Ahlfinger
Paul Brown
Scott Coleman
Jeff Dickman
Kimber Lynn Drake
Larry Fischer
Dave Fisher
Frank Graninger
Rick Green
Dave Hagemeier
John Haydu
Joe Kann
Mike Kent
John Lewis
Jerry McCarthy
Sheri Rasmussen
Greg Reynolds
Jerry Rondorf
Marv Schilt
Chuck Schroeder, The Brady Company
Barbara Steinberger
Dick Steinmetz
Irene Timm
Heinz Unterweger
Tami Witt
Steve Zimmermann
Thank you, everyone, and best regards to safety-conscious managers everywhere.
James J. Jerschefske
Project Manager
Rockwell Automation/Allen-Bradley
TABLE OF CONTENTS
Chapter 1 — Introduction
5.5 Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63
5.6 Normally energized circuits. . . . . . . . . . . . . . . . . . . . . 64
5.7 Control circuits and performance categories . . . . . . . . 66
5.8 Category B and Category 1 . . . . . . . . . . . . . . . . . . . . . 66
5.9 Category 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
5.10 Category 3 and category 4. . . . . . . . . . . . . . . . . . . . . . 70
Glossary of Terms
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97
Appendices
CHAPTER
Introduction
New laws impact equipment
manufacturers and end-users . . . . . . . . . . . . . . . . . . . . . . 1.0
A global road map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1
Does the Machinery Directive apply to me? . . . . . . . . . . 1.2
Good intentions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3
1 1.0
2
Though European in origin, these safety-related directives impact original equipment
manufacturers (OEMs), end-users and multi-national corporations everywhere. With components
sourced from around the world, the final destination and use of a product often remains unknown
to its manufacturer. Further, companies producing machinery for Europe often turn to their
suppliers for information and support as part of their effort to comply with the directives.
1
1.1
1.2
DISPLAY, (ACTUATORS),
CONTROL DEVICES
WARNING
DATA STORAGE
CONTROL
SYSTEM AND LOGIC OR ANALOG
DATA PROCESSING
OPERATOR-
MACHINE SENSORS,
INTERFACE SAFETY DEVICES POWER CONTROL
ELEMENTS
4 (contactors, valves,
speed controllers, etc.)
MACHINE ACTUATORS
(engines, cylinders)
OPERATIVE
PART
GUARDS
OPERATOR-
MACHINE
INTERFACE
Fig. 1.0 General schematic representation of a machine (from EN 292-1, Annex A).
According to the Machinery Directive, only companies building a “machine” for the EU
market need to apply CE marking. Many individual components and sub assemblies — such as
those having no independent source of energy or those that are not safety components — may
not need marking at all, or they may be CE marked according to other directives.
1
1.3
Good intentions
The overall charge of the Machinery Directive explains that “...Member states are
responsible for ensuring the health and safety...of workers, notably in relation to the risks
arising out of the use of machinery. The social cost of the large number of accidents caused
directly by the use of machinery can be reduced by inherently safe design and construction
of machinery and by proper installations and maintenance.”
Further, the directive mandates a common sense approach for addressing safety (e.g., “Each
machine must be fitted with one or more emergency stop devices to enable actual or impending
5
danger to be averted”). Also helpful are the standards supporting the directive, which provide a
process for identifying hazards, assessing risk and implementing measures to improve reliability,
reduce the possibility of failure or increase the probability of detecting a failure.
Ultimately, the directives reduce bureaucracy and help OEMs make their products as safe
as possible while being realistic about design and usage demands. In the event of an accident,
the directives also may offer proof of due diligence.
The designer encountering European safety laws for the first time may feel overwhelmed
by all the new safety-related numbers and acronyms.
2
CHAPTER
Acronyms? Numbers? Help!
The European market . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.0
So what directives should I examine? . . . . . . . . . . . . . . . 2.1
Standards to clarify directives . . . . . . . . . . . . . . . . . . . . . 2.2
Sources for standards . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.3
CE Marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4
Interpretations may vary . . . . . . . . . . . . . . . . . . . . . . . . . 2.5
Applying components properly . . . . . . . . . . . . . . . . . . . . 2.6
2 2.0
2.1
@@
ÀÀ
;;
;;
@@
ÀÀ
@@;;
ÀÀ
;; @@
ÀÀ
;;
;@À;
ÀÀ
@@
@@
ÀÀ
;;
À
@
9
Machinery builders must thoroughly familiarize themselves with the Machinery Directive and associated standards.
2 2.2
CE marking
When machinery manufacturers place CE marking (Figure 2.0) on their product, they
are stating that the product complies with all applicable directives. To affix CE marking to
2
a product, manufacturers must issue a Declaration of Conformity (DOC). This is a formal,
signed statement indicating conformity of the referenced product to the listed provisions
of the applicable directive(s) and standards.
Most machine manufacturers — about 95 percent — can self-certify their compliance with
the Machinery Directive (i.e., it is not mandatory to use an outside agency in most cases). A
few product categories, including high-risk machinery such as punch presses, saws, etc.,
require third-party certification by a Notified Body.
If the product is not manufactured in the EU/EEA, it may be advantageous for the machine
builder to establish an authorized representative located within the EU/EEA. The authorized
representative should be easily accessible, have ready access to the DOC, and be able to
supply supporting information on request.
13
Fig. 2.0
2 2.5
2.6
15
Machinery builders must apply control components in an appropriate manner to satisfy Machinery
Directive requirements. Remember: Simply using components with CE marking does not mean your
machine meets CE requirements.
Without a road map, the path to CE conformity can seem long and confusing.
3
CHAPTER
The Road Map
Starting out . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.0
EN 292 — Basic concepts of machine safety . . . . . . . . . 3.1
The directives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2
EMC Directive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3
The Low Voltage Directive . . . . . . . . . . . . . . . . . . . . . . . 3.4
The Product Liability Directive . . . . . . . . . . . . . . . . . . . . 3.5
Examining Type A, B and C Standards . . . . . . . . . . . . . . 3.6
Annex I — Essential Health and Safety Requirements . . 3.7
Risk assessment — EN 1050 . . . . . . . . . . . . . . . . . . . . . 3.8
Risk estimation — EN 1050 + EN 954 . . . . . . . . . . . . . . 3.9
Performance categories — EN 954 . . . . . . . . . . . . . . . . 3.10
Risk, performance and selection . . . . . . . . . . . . . . . . . . 3.11
Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12
3 The Road Map
Yes No
Affix
CE marking
Fig. 3.0 Basic approach to obtaining CE marking [Note: A, B and C standards are explained in section 3.6 of
this book].
3.0
Starting out
Viewed graphically (see Figure 3.0), the process of obtaining CE marking looks quite
manageable. The authors suggest that manufacturers approach the task as a series of steps and
3
think of it as a process for incorporating safety into machinery.
This section cites specific standards and directives and quotes sections of them. The intent
is to expose readers to the standards in a controlled manner, and to direct readers to the sections
that will be most helpful to them.
3.1
Risk estimation
Yes
Risk evaluation
Validate results
Yes
Yes Yes No
Fig. 3.1A Procedure for suppliers to assess and reduce risk (from proposed update to EN 292-1).
â User
Risk evaluation
Validate results
No No
21
Additional safeguards
(guards, protective devices,
protective measures, personal
protective equipment Develop safe working
procedures â
Fig. 3.1B Procedure for users to assess and reduce risk (from proposed update to EN 292-1).
3 EN 292-2 provides an overview of the technical principles and specifications for
incorporating safety into a machine; e.g., avoiding or reducing as many of the hazards
as possible by using the most suitable design features, and by limiting a person’s exposure
to hazards by reducing the need for operator presence/intervention in danger zones.
EN 292-2 addresses risk reduction by design, safeguarding (see Figure 3.2), creating
“information for use” (i.e., an owner’s manual) and additional precautions designers can take
related to improving safety.
Hopefully, just the brief information and charts referenced here have convinced
manufacturers that the standards establish a helpful framework for designing safe machines.
22
Fig. 3.2 EN 292-2 provides information on how to incorporate safety into a machine, such as this diagram
for choosing safeguards.
Familiarization with the basic concepts of machine safety
Read and understand the Machinery Directive
Review other Directives for applicability
3
3.2
The Directives
From the definition of “machinery,” to a machinery manufacturer’s ability to demonstrate
conformity, to applying the CE marking, the Machinery Directive sets forth the laws with
which all manufacturers must comply. Although moderately long (see Figure 3.3) and written
like a legal document, all manufacturers must read the Machinery Directive. It is the law, and
ignorance of the law is no excuse for failing to comply.
Articles 1-14 of the Machinery Directive are written in legal jargon. Conversely, Annexes I-VII
of the Machinery Directive are relatively easy to follow. The Annexes are very important, and
particularly Annex I, which covers Essential Health and Safety Requirements (EHSRs).
After the Machinery Directive, manufacturers must review other directives for applicability
(note: multiple directives often apply). The three directives most likely to apply to machinery
using control products are the Electromagnetic Compatibility (EMC) Directive (89/336/EEC), 23
the Low Voltage (LV) Directive (73/23/EEC), and the Product Liability (PL) Directive
(85/374/EEC).
There are also directives for batteries, explosive atmospheres, simple pressure vessels,
personal protection equipment and dangerous substances.
Fig. 3.3
3.3
EMC Directive
Apparatus must comply with the EMC Directive when it is liable to cause electromagnetic
disturbances or its performance is liable to be affected by such disturbances. This is particularly
3
true if the disturbance results in a sudden risk increase, which then becomes a safety issue
(e.g., initiation of an unexpected motion as the result of an inductive proximity sensor
triggering “On” accidentally).
The EMC Directive states that all “apparatus” placed in the EU/EEA market shall be
constructed so that:
• “The electromagnetic disturbance it generates must not exceed a level allowing
radio and telecommunications equipment and other apparatus to operate as intended.”
• “The apparatus has an adequate level of intrinsic immunity to electromagnetic
disturbance to enable it to operate as intended.”
Most products that make use of electrical energy generate, or are susceptible to, electromagnetic
fields. Annex III of the EMC Directive states that electromagnetic disturbance generated by a
product should especially not hinder apparatus such as: industrial manufacturing equipment,
mobile radio equipment, telecommunications networks and apparatus, information technology
25
equipment, domestic appliances, and lights and fluorescent lamps. Though not called out in the
directive, be especially aware of the effects of motors and electric drives, “crosstalk” between
power cables, and inadequate or improper grounding.
3.4
27
CEN/CENELEC divides the EN standards into three groups according to the subject(s)
they cover and also makes them hierarchical in nature (see Figure 3.4). To obtain CE marking,
manufacturers must determine which standards apply to their products, then review and apply
the appropriate ones.
3 Type A standards cover fundamental safety
standards, apply to all types of machinery, and are
essential reading. The two most important Type A
standards for manufacturers to review are EN 292
Safety of machinery (discussed in section 3.1) and
EN 60204 electrical checklist
3.7
3.8
3.9
31
3 Estimate the severity (possible degree of harm) by considering the:
• Severity of injury:
S1 Slight (normally reversible) injury or damage to health
S2 Serious injury or damage to health (normally irreversible, including death)
When a hazardous situation occurs, P1 should only be selected if there is a realistic chance of avoiding an accident
or of significantly reducing its effect. P2 should be selected if there is almost no chance of avoiding the hazard.
Category
Starting point
B 1 2 3 4
S1
P1
F1
P2
S2
P1
F2
P2
32
Category selection
NOTES: 1. Annex B is informative, not normative. The correct use of EN 954-1 requires attention to ALL
of its clauses, not just the requirements for its categories.
2. Two common misconceptions occur with the categories noted in EN 954-1: that they represent
levels of risk and that they are hierarchical. THIS IS NOT TRUE. The categories should be
considered as reference points for the performance of a safety-related part of a control system
with respect to the occurrence of faults.
3. A weakness of EN 954-1 is that the categories are basically defined in terms of performance
under fault conditions. As such, there is no mechanism for culturing the choice of a given
performance category by the comparative reliability of differing risk abatement options or
technologies. The 1996 version of EN 954-1 is currently being reviewed to address this situation.
Once a hazard is identified, it is important to know if it can be identified by physical
means (i.e., watching the machine move) or only by technical means (i.e., indicators). Other
important aspects which influence the selection of parameter P (Possibility) include:
• Operation with or without supervision
3
• Operation by experts or non-professionals
• Speed with which the hazard arises
• Possibilities for avoiding the hazard (reaction time, third-party intervention)
• Practical experience relating to the process
• Probability that the harmful event will occur
3.10
Category
B
Basic Requirements
Requirements of cat. B and Machine can only start Machine can only start up
2 when system is safe. when system is safe and
the use of well-tried safety
principles together with: faults will be detected by
A safety function check a frequent check (i.e.,
at machine start-up and high level of safety
periodically if required. performance).
NOTES: 1. If, as a consequence of a fault, further faults occur, all the linked faults shall be considered
as a single fault.
2. Common mode faults are regarded as a single fault.
3. The occurrence at the same time of two independent faults is not considered.
Guide to the Categories for Safety-Related Parts of Control Systems From EN 954-1
Category
B
Factors affecting the
degree of performance
Availability of standards,
test data, etc.
Typical techniques
1 The simplicity or complexity • Positive mode operation, life • Fault analysis (e.g., Failure
of the system and principle testing, oriented failure Mode and Effects Analysis
(i.e., fewer components mode (e.g., defined weak or Fault Tree Analysis)
means fewer potential modes link - relevant to simple • Testing.
of failure and more viable (e.g.,mechanical) equipment
• Checking of safety margins.
validation). • Validation measures are
usually too involved or not
possible for more complex
(e.g., electronic) equipment.
3 The frequency and nature of • Dual contact (or two Theoretical analysis
the check (i.e., more frequent separate) devices linked by and/or testing. 35
checks allows less time for two circuits to a separate
faults to accumulate). unit which compares
operation of each circuit
at change of state
• Suitable where some faults
cannot be prevented and
there is relatively frequent
actuation —particularly
relevant
to electro-mechanical
technology.
Category 1
A well-tried component for a safety-related application is a component which has been:
1) widely used in the past with successful results in similar applications; or 2) made and
verified using principles which demonstrate its suitability and reliability for safety-related
applications. In some well-tried components, certain faults can be excluded because the fault
rate is known to be very low.
Well-tried safety principles are, for example:
– avoidance of certain faults; e.g., avoidance of short circuit by separation
– reducing the probability of faults; e.g., over-dimensioning or underrating
of components
36 – orienting the mode of fault; e.g, by ensuring an open circuit when it is vital
to remove power in the event of fault
– detecting faults very early
– restricting the consequences of a fault; e.g., grounding of equipment
Newly-developed components and safety principles may be considered equivalent
to “well-tried” if they fulfill the above mentioned conditions.
Note: On the level of single electronic components alone, it is not normally possible
to meet category 1 requirements. See Appendix D for a list of some significant faults and
failures for various technologies.
Safety categories ≠ Safety
hierarchy
Category 2
Any check of safety functions (which can
be automatic or manual) shall either: 1) allow
operation if no faults are detected; or 2) generate
3
Designers should note that an output which initiates control action if a fault
performance categories do not is detected. When possible, this output shall
indicate a safety hierarchy (i.e.,
initiate a safe state (e.g., prevent starting/restarting
category 4 is not necessarily safer
than category 1). Rather, these if the safety function is not available). When
categories state the required not possible, the output shall provide a warning
behavior for a safety system in of the hazard. In some cases, category 2 does
relation to its resistance to faults.
not apply because checking cannot be applied
Thus, according to the performance
category required, machine designers to all components, e.g., a pressure switch or
must select safety-related parts on temperature sensor.
their ability to resist faults (i.e., both
reliability and availability of the Category 3
safety function must be considered).
Typical examples of feasible measures for
Safety ≠ reliability fault detection are the connected movement
of relay contacts (i.e., “positive guidance”)
However, designers must not 37
confuse reliability and safety. For or monitoring of redundant electrical outputs.
example, a system with unreliable “Feasible” means that fault detection measures,
components in a redundant structure
and the extent of their implementation, depends
can provide more safety than a
non-redundant system with better mainly on the consequence of a failure and the
components. This concept is probability of the occurrence of that failure. The
important because in applications technology used influences the possibilities for
where the consequences of failure
implementing fault detection.
are serious, safety requires the
higher priority regardless of the
Category 4
reliability achieved. Designers may
want to refer to Annex D of EN 954 Fault review may be stopped when the
for more details. probability of further faults occurring is sufficiently
low. The number of faults considered “sufficiently
3 low” varies. For example, in the case of complex microprocessor circuits, a large number
of faults can exist. Conversely, in an electro-hydraulic circuit, two or three faults can be
sufficient to initiate a safety action.
Fault review may be limited to two faults in combination when: the fault rates of the components
are low AND the faults in combination are largely independent of each other AND the faults have
to appear in a certain order to jeopardize the safety function.
38
When making purchasing decisions, consider that well-tried components help meet category 1
and higher requirements.
3.11
Summary
By using EN 1050 and EN 954, the machine designers’ objective is to ensure that the
safety-related parts of a control system produce outputs which can achieve risk reduction
objectives. The process for selecting and designing safety measures takes five steps.
40 Step 3: Specify safety requirements for the safety-related parts of the control system
- Specify the safety functions to be provided in the control system [Appendix E
provides a list of typical safety functions which can be provided by the safety-related
parts of a control system. The list also references the relevant parts of standards.]
- Specify how the safety functions will be realized and select the category(ies) for each
part and combinations of parts within the safety–related parts of the control system.
Step 4: Design
- Design the safety-related parts of the control system according to the specification
developed in step 3 and to the general strategy for design. List the design features
included which provide the design rationale for the category(ies) used.
- Verify the design at each stage to ensure that the safety-related parts fulfill the
requirements from the previous state in the context of the specified safety function(s)
and category(ies).
Step 5: Validation
- Validate the achieved safety functions and category(ies) against the specifications
in step 3. Re-design as necessary.
- When programmable electronics are used in the design of safety-related parts
3
of the control systems other detailed procedures are required (see Notes 1 and 2).
Note 1: It is believed at present that it is difficult to determine with any degree of certainty,
in situations when a significant hazard can occur due to the malfunction of the control system,
that reliance on correct operation of a single channel of programmable electronic equipment
can be assured. Until such time that this situation can be resolved, it is inadvisable to rely on
the correct operation of a single channel device (according to 11.3.4 of EN 60204-1).
Note 2: A proposed international standard, IEC 1508, may provide more guidelines for
the functional safety of programmable electronic systems when such systems are used as
safety-related systems.
To facilitate the design process, Annex A of EN 954 lists some important aspects to
consider during the design process. These are:
1. What reaction is required from the safety-related parts of the control systems(s)
when faults occur?
41
a) No special action required.
b) Safe reaction required within a certain time.
c) Safe reaction immediately required.
2. In which safety-related part(s) of the control system should faults be assumed?
a) Only in those parts in which (by experience) faults occur relatively often;
e.g., in the peripheral sensors and wiring.
b) In auxiliary parts.
c) In all safety-related parts.
3. Have both random and systematic faults been considered?
3 4. Which faults should be assumed in the components of the safety-related parts
of the control system?
a) Faults only in components which are not well-tried. [“Well-tried” not
in the sense of reliability, but from the view of safety.]
b) Faults in all components.
5. Has the correct reference category been selected as it relates to the requirement
for detecting faults?
a) Normal requirements for fault detection. [This means that all faults which
can be detected with relatively simple methods should be detected.]
b) Strong requirements for fault detection. [This means that techniques should be
used which enable most of the faults to be detected. If this is not reasonably
practical, combinations of faults should be assumed (fault accumulation).]
6. What shall be the next action of the control system if a fault has been detected?
a) The machine should be brought to a predetermined state as required by the
risk assessment.
b) Further operation of the machine can be permitted until the fault is rectified.
CHAPTER
Post Design and
Construction Requirements
So you’ve complied with requirements — now what? . . . . . 4.0
Information for use . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1
Advice for drafting information for use. . . . . . . . . . . . . . 4.2
The Technical File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3
Declaration of Conformity . . . . . . . . . . . . . . . . . . . . . . . 4.4
Can you self-certify?. . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5
CE marking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6
4 4.0
46
4.1
4.2
48
A “Technical File” is the principle means of assessing conformity. Only national authorities of an
EU/EAA country have the right to see it.
Generate Technical File
4
4.3
51
4.4
Declaration of Conformity
The EC Declaration of Conformity (DOC) is the procedure by which manufacturers
declare that the machinery being placed on the market complies with all the Essential
Health and Safety Requirements (EHSRs) applying to it. Signing the DOC authorizes
4 the manufacturer to affix the CE marking to the
machinery. A copy of the DOC must accompany
each product sold.
4.5
54
1 unit 1 unit
3 units
7 units
3 units 55
1 unit
17 units
CHAPTER
Safety Category Requirements
Why include safety and safety-related components? . . . . 5.0
Well-tried components and design principles. . . . . . . . . . 5.1
Direct opening action contacts . . . . . . . . . . . . . . . . . . . . 5.2
Positively driven contacts . . . . . . . . . . . . . . . . . . . . . . . . 5.3
Redundancy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.4
Normally energized circuits . . . . . . . . . . . . . . . . . . . . . . 5.5
5 Chapters 1 through 4 of this handbook guided readers through the logistics of obtaining
CE marking. Now, chapters 5 and 6 will provide information that shows readers how to select
and apply control-related products while considering requirements of the directives and
standards. Specifically, chapter 5 focuses on the design of safety-related control products,
as well as the safety categories introduced in section 3.10. Chapter 6 focuses on the electrical
safety of control components.
5.0
5.2
Contacts welded
60
Key In Place
Contacts
Contacts
Welded
Welded
61
Key Removed
Weld
Forced Open
0.5 mm minimum
NO NO (single contact)
or
Contact A 2 x 0.3 mm minimum
Linked contacts Mechanical link (double contact)
NC NC
Contact B welded
Anti-tease features
Clause 6.2.1 of EN 60947-5, which covers E-Stops, states that “it shall not be possible for
the emergency stop device to latch-in without generating the emergency stop signal.... In case
5
of failure, the emergency stop device, the generation of the emergency stop signal shall have
priority over the latching means.”
In addition, clause 4.1.1 of EN 418 states that “any action on the actuator which results
in generating the emergency stop command shall also result in the latching-in of the control
device so that when the action on the actuator is discontinued, the emergency stop command
shall be maintained until the control device is reset (unlatched).”
These standards require IEC-style E-Stops to provide a means whereby the device’s
operator will never be in a latched-in state without the normally closed contact opening.
Further, if the contacts are welded or obstructed from opening, the operator should not be
allowed to latch.
By convention, manufacturers have used a feature called trigger action to achieve this.
Trigger action describes an operator that has a point of no return in its travel, after which the
contacts move through their full stroke. Some gate interlock switches also employ a similar
“point of no return” feature, and these interlocks are said to be of a “snap acting” design.
5.5
Redundancy 63
Using devices with different operating principles or using more than one device to perform
a control function increases circuit reliability. This is called redundancy, and it is a good design
practice that can fulfill category 2 and 3 functions for the safety of control circuits.
Figure 5.4 shows a sliding guard which closes off gears. Notice how it helps avoid failures
of the same kind by combining a limit switch with a positive mode NC contact with a second
limit switch that has a negative mode NO contact.
5 Moving guard
S1 S2
5.6
5
Limit switch
E-Stop
65
B 1 2 3 4
Fig. 5.5 Safety category requirements; note the cumulative nature of the requirements.
66
5.8
On/Off
5
pushbutton CR
CR M OL
24V
+V
67
CR
CR Pusher Controls M OL
NOTE: These diagrams conform to NEMA style. For an IEC version, please refer to Appendix H.
5 it has been applied properly). Further, assuming
the E-Stop is of the direct opening action type, its
normal failure mode is in the
open circuit mode. If the contacts are tack welded
shut, they should be forced open on actuation,
Designer’s Discretion
Category 2
From category 2 upward, the higher degree of safety results from the structure of the safety
circuits and the prevention and detection of faults (i.e., not only the choice of components).
5
This category requires a check of the safety function at suitable intervals; e.g., at the
beginning of each operation cycle, upon start-up, or at established times during the cycle
(it is the manufacturer’s responsibility to specify an appropriate interval). If a fault is detected
during start-up, the machine must be prevented from starting. If the safety function is lost
during a cycle, the loss must be detected at the next start-attempt.
Circuits for category 2 machinery — perhaps a pick-and-place robot has been added
to a fast moving conveyor — must focus on fault prevention. Two fault prevention techniques
include adding redundancy and using contactors with normally energized output circuits.
Figure 5.8 shows the circuit diagram of a redundant system. When the start button is
pushed under normal operating conditions, current will flow through the NC contacts CR1(a)
and CR2(a), energizing output coils CR1 and CR2. Then contacts CR1(b) and CR2(b) close
and maintain current flow; the NC contacts CR1(a) and CR2(a) drop out. If one of the contacts
welds during operation (e.g., CR1(c)), it is still possible to remove power from the load using
the E-stop. A restart would not be possible because the NC contact CR1(a) would remain in an
energized (i.e., open) state.
This fulfills category 2 requirements because the safety function is checked at the start of
each cycle. It also can fulfill some category 3 requirements because a single fault will not 69
5.10
72 Jumper
Note: In order to minimize the potential for shorting of channel 1 to channel 2, which would not be detected
by the circuit, the wiring should be installed in separate conduits.
6
CHAPTER
Safety Concerns for
Power-Related Products
Operational functions . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.0
Contact reliability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1
Multiple fault detection. . . . . . . . . . . . . . . . . . . . . . . . . . 6.2
Motor protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3
Safe separation of circuits to avoid electrical shock. . . . . 6.4
Protection against electric shock . . . . . . . . . . . . . . . . . . . 6.5
Protection against indirect contact. . . . . . . . . . . . . . . . . . 6.6
6 6.0
Operational functions
The European Norms provide both broad guidance and great detail on safety functions
“which are safety critical functions other that safety-specific* functions” — that is,
components which provide critical operational functions. According to EN 60204-1, this
includes products such as power supply disconnecting devices, enclosures, power circuits,
control circuits and motor overload protection. Properly applying these devices, according to
EN 1037, helps assure proper start-up, prevent unexpected start-up, and isolate the machine
from its energy supply to enable safe maintenance or other work.
As with the safety components discussed in chapter 5, there are numerous well-tried design
principles manufacturers should look for when selecting power-related safety components.
Some of these principles are:
• Contact reliability
• Multiple fault detection
• Short-circuit protection for safety
• Safe separation of circuits for avoidance of electrical shock
• Protection against electric shock (“finger proof ”)
• Protection against indirect contact
* Recall that the products discussed in the previous chapter provide safety-specific functions (e.g., the primary
purpose of a cable pull switch is to serve as a safety-stop device, not as a routine stop button).
6.1
76
Contact reliability
Many control circuits operate at 24V DC levels, which is common for PLC systems
and other electric controls. The contacts of power devices like contactors, circuit breakers or
switches, as well as the contacts of relays and sensors, have to work reliably at these signal
levels. The same contacts must perform reliably at conventional loads with high AC-15 ratings.
Devices using “cross stamped” and “H bridges” (see photo on next page) perform excellently
under these conditions and improve reliability and safety control circuits.
6
Cross stamped (left) and H bridge contacts.
6.2
6.3
77
Motor protection
Motor starters (motor protection) are available with short-circuit coordination levels of
Type 1, Type 2 and CPS. The contactor and overload relay are tested with appropriate short
circuit protective devices, typically fuses or a circuit breaker, to determine the coordination
levels. After a short circuit, an interruption of service is unavoidable while the source of the
failure is traced and cleared. However, the type of coordination will determine the length
of the interruption (see Figure 6.0).
6 • Trace and clear failure
after short-circuit
Type "1"
X
Type "2"
X
Type "CPS"
• Inspect starter
• Exchange components X
• Break-off welded
X
contacts if any
• Restart operation X X X
• Planned maintenance X X X
After a short circuit with Type 1 coordination, the starter components (contactor, overload,
motor protection circuit breaker) may be defective and need replacing. A restart is only possible
after replacing starter components, which could take some time if the components are not
immediately available.
Type 2 coordination ensures that the starter components stay serviceable after a short
circuit (the contacts may weld slightly, but they can be separated with a screwdriver). No
replacement parts are needed before restarting the machine.
Type CPS (IEC 947-6-2, Control and Protective Switching devices, CPS) coordination
devices ensure that the starter components stay serviceable after a short circuit, that no
replacement parts are needed before restarting the machine and that the starter will deliver
additional operations at rated load without any inspection of components. [Note: While Type 2
78
and Type CPS allow component replacement, the components eventually require replacing
because short circuits cause heavy contact wear.]
Correctly coordinated motor starters — regardless of their type — ensure that in case of a
short circuit, no damage occurs outside the starter. This contributes to the protection of nearby
personnel and control components.
In addition, many circuit breakers and fuses for motor protection offer high current limiting
capabilities to reduce fault energy to very low levels. These lower energy levels reduce the
danger to personnel and damage to surrounding equipment. This enables short restart times,
particularly when short circuit coordination Type 2 or Type CPS is chosen. Further, devices
with high current limitation do not require oversizing of the contact to achieve Type 2 or Type
6
CPS coordination.
6.4
Insulating barrier
PELV 1 PELV 2
79
Starter coil
Insulating barrier
Magnet
80
Fig. 6.2 PELV and SELV contactors provide safe separation between circuits.
6.5
6.6
82
83
CHAPTER
Frequently Asked Questions (FAQs)
7 Big Picture FAQs
1. What do the EU directives address?
Three basic areas: 1) Safety of individuals; 2) Protection of the environment; and
3) Free movements of goods within the EU/EEA geographical regions through
harmonization of standards and the elimination of trade barriers.
10. What are “harmonized” and “national” standards? How do they impact my efforts
to be compliant with the EU directives?
The European Norms are harmonized standards, which means that they are applicable
in, and recognized by, all EU countries. Showing conformity with harmonized standards
is considered the easiest way to demonstrate compliance with the EU directives.
National standards are standards within a country that are singular to that country, and
they may differ from the harmonized standards. National standards have no impact on
complying with the EU directives. 87
11. What is the relationship between the Machinery Directive and OSHA requirements
for safety? Does having one mean you comply with the other?
The EU directives and OSHA requirements are independent of one another, so having
one does not mean that you comply with the other. If you want to sell your machine in
both the EU and the U.S., you need to understand both sets of requirements.
7 12. Will the Machinery Directive ever displace OSHA or ANSI design guidelines?
No, because the electrical codes and installation requirements differ between North
America and Europe. However, they are getting closer over time.
13. Does CE marking or the DOC certify compliance with the no PCBs/no asbestos
requirement of Europe?
The use of asbestos is covered by one of the Marketing Directives and Use of Dangerous
Substances Directive. Where asbestos is used, these directives apply. These directives do
not mandate CE marking, but a machine bearing CE marking must meet their requirements.
14. What impact do the EU safety directives have on equipment built in, and destined
for, the U.S.?
Legally, the directives have no impact on the U.S. In practice, however, manufacturer’s
may try to build one piece of equipment that satisfies both EU and U.S. requirements
to improve manufacturing efficiency.
20. How do I know if my risk assessment is accurate? How do I know when I’m done?
EN 292-1 and EN 292-2 discuss risk in great detail, and Annex B of EN 1050 covers
methods for analyzing hazards and estimating risk. Figure 3.1 in this handbook depicts
the strategy for selecting designed-in safety measures and indicates when you should
ask yourself “Is safety adequate?”
27. What standards address which products? Do the standards vary by location?
The list of standards is exhaustive. Appendix B of this handbook provides a short, partial
list of those most likely to relate to machine builders. Section 2.3 of this handbook notes
sources that can provide you with the complete standards list.
For any country requiring CE marking, use the European Norms. IEC or ISO standards
may also be acceptable.
29. What is the penalty for failing to comply with the Machinery Directive but placing
CE marking on the machine?
Article 7.3 of the Machinery Directive, a law, states that “where machinery which does
not comply bears CE marking...the Member State shall take appropriate action against
whomsoever has affixed the marking...and shall so inform the Commission [of the EU]
and the other Member States.”
Safety relays are designed to eliminate the potential for a single contact to cause a failure
that would not allow the system to shut down. This function helps meet risk category 3 or
4 requirements: detection of a single failure, maintenance of the integrity of the E-Stop
function and prevention of a restart until the fault is cleared. A safety relay is really
a combination of several relays wired into a circuit that provides the safety functions
noted above. Remember, the Machinery Directive does not require the use of any
particular product; it specifies function and performance requirements. A safety relay
is a means to this end.
No. Simply replacing the MCR with a safety relay does not directly correlate with making
the machine comply with the Machinery Directive. The safety relay must be applied
according the relevant directives and standards.
7 36. How do safety interlock switches interface with a safety relay? Are they an input
to the relay or are they a load?
A safety interlock interfaces the same way an E-Stop button interfaces: as an input to the
relay. In some applications, the interlock contacts will be wired in series with the E-Stop.
39. Do I have to use a safety relay in conjunction with every electrical safety device,
e.g., safety interlock switch, light curtain, safety mat, E-Stop, etc.?
Not necessarily, as it depends on the application and the control system. The risk
associated with your machine might not require a safety relay. Also, you may not have
to use a separate safety relay with each input device. For example, a safety interlock
switch, light curtain and E-Stop related to the same hazard may be wired in series
to one safety relay.
40. If I have redundant safety input devices, does this eliminate the need
for a safety relay?
No. Redundancy does not deliver the same function as a safety relay.
41. What is the current OSHA ruling on safety relays and switches?
92 Just like the European directives and standards, the OSHA requirements look to a certain
level of performance for the control system. It does not specify products. By design, a
safety relay can help provide the performance OSHA seeks.
Rockwell Automation/Allen-Bradley FAQs
42. What do “positively guided” and “positive break” mean and how do they differ?
Does Rockwell Automation offer products with these features?
Positively guided refers to the electronic actuation of relay contact/auxiliary contact
7
actuation on starters. Positive break refers to the mechanical actuation of devices like
an interlock switch or E-stop button. Chapter 5 of this book provides detail on their
differences.
43. Can customers build their own safety relay using Rockwell Automation
components, and will it be approved?
Yes, they can build their own safety relay using Rockwell Automation components (or any
other components, and using any other design) provided that resulting performance meets
the performance required by the applicable directives. It will be approved if they can prove
compliance with the directives.
44. Can I obtain a list from Rockwell Automation of all its CE marked control
components? What other CE information does Rockwell Automation have?
Yes. Please ask your local Rockwell Automation representative for a list. Information
about our products and the CE mark in general is available on Rockwell Automation’s
Internet site at www.ab.com. Click on the “Allen-Bradley and the CE mark” button.
48. Do the new MCS control relays, including Adder Decks, incorporate positively
guided contacts?
Yes.
94
GLOSSARY
Glossary of Terms
ANNEX - An appendix, as might be used with a Council Directive.
CE MARKING (CE mark) - The identifying mark, consisting of the letters “CE” that, together
with an EC Declaration of Conformity, indicates conformity of the product to which it is
affixed to the essential health and safety requirements of the relevant directive(s). Allows
products to be sold anywhere in the EU. CE Marking is mandatory for most products
in the EU. CE stands for European Community in French
DIRECTIVE - Legislation which is binding on all Member States that has been adopted
by the Council of the European Communities.
EUROPEAN UNION (EU) - The regional geographic and economic union formed by 15
European nations bound by treaty to form a single European Economic Community.
The countries are (as of January 1, 1997) Austria, Belgium, Denmark, Finland, France,
Germany, Greece, Ireland, Italy Luxembourg, Netherlands, Portugal, Spain, Sweden and
the United Kingdom.
HAZARD - An event that can cause physical injury and/or damage to health or property.
Annex A of EN 1050 provides examples of hazards, hazardous situation and hazardous events.
MACHINERY DIRECTIVE - EU legislation (law) that lays down the essential health and safety
requirements applying to machinery, as defined in Annex I. It also covers safety components
placed on the market separately.
RISK ASSESSMENT (or risk analysis) - From EN 1050, which establishes general
principles and procedures for identifying hazards and evaluating risks as they relate
to decisions made on the safety of machinery.
RISK ESTIMATION - The risk associated with a particular situation or process is derived
from a combination of the severity of harm and the probability of occurrence of that harm.
Probability of occurrence involves the frequency and duration of exposure, probability of
the event occurring, and probability of avoiding or limiting the harm. Based on risk level
(Annex B of EN 954 provides a decision tree), a machine can be required to have control
systems that meet the requirements of a particular safety category.
RISK REDUCTION - Manufacturers must apply the following principles when designing
a machine: eliminate or reduce risks as far as possible; take the necessary protection
measures in relation to risks that cannot be eliminated; and inform users of the residual
risks due to any shortcomings of the protection measures, indicate whether any particular
training is required and specify any need to provide personal protection equipment.
TYPE A STANDARDS - Fundamental safety standards that cover the basic concepts, principles
and general aspects of all machinery.
TYPE B STANDARDS - Group safety standards. They cover one safety aspect, one type of
safety-related device and a wide range of machinery.
TYPE C STANDARDS - Detailed safety requirements for a particular machine or class of machines.
101
APPENDICES
Appendices
A Appendix A — Select Type B standards
Type B1 and B2 standards (basic safety standards) deal with one safety aspect or one type of
safety-related device for a range of machinery. The following is a brief list (as of March 1, 1997):
General
EN 954-1: Safety-related parts of control systems
EN 953: Design and construction of guards
EN 1088: Interlocking devices w/& w/o guard locking
EN 982, 983: Fluid power systems
EN 294, 349, 811: Safety distances
EN 999: Hand/arm speed
EN 626: Hazardous substances
EN 1093: Emission of hazardous substances from machines
EN 1127-1: Fire and explosions (this work is now part of CEN/TC 310)
EN 1760: (2) Pressure-sensitive protective devices (mats, bumpers, edges, etc.)
Electrical
EN 60204-1: Basic electrical requirements
IEC 1131: Programmable controllers
IEC/CD 1508: Safety-related systems — electrical, electronics, programmable
electronics
EN 418: Emergency stop equipment
EN 574: Two-hand control devices
EN 50100: Electrosensitive protective equipment
EN 61310 (50099): Visual, tactile, and audible signals
EN 60947: Low-voltage switch gear and control gear
Part 1: General rules
Part 2: Circuit breakers
Part 3: Switches, disconnectors, switch-disconnectors and fuse
combination units
Part 4: Contactors and motor starters
Part 5: Control circuit devices and switching elements
Part 6: Multiple function equipment
Part 7: Ancillary equipment
EN 60947-5-2: Proximity devices
104
Ergonomics
EN 614-1:
EN 547:
EN 563:
EN 894:
Ergonomic design principles — terminology & general principles
Human body dimensions
Temperature of touchable surfaces
Ergonomic requirements for the design of displays & control
A
actuators
EN 981: System of danger and non-danger signals with sound & light
EN 1005: Human physical performance (3 parts)
Acoustics
EN 2374X: Acoustics — Determination of sound power levels of noise sources
EN 24871: Acoustics — Noise labeling of machinery and equipment
Electromagnetic Compatibility
EN 50081-2: Electromagnetic compatibility — Generic emission standard —
Part 2: Industrial environment
EN 50082-2: Electromagnetic compatibility — Generic immunity standard —
Part 2: Industrial environment
Vibration
EN 1031: Measurement of whole body vibration — General requirements
EN 1032: Testing of machinery in order to measure the whole-body vibration
emission value — General requirements
105
Appendix B — Electrical equipment of machines
After completing a risk assessment (covered in sections 3.8 - 3.12 of this book), OEMs should
fill out an “Inquiry form for the electrical equipment of machines.” This is reproduced from the
EN 60204-1 standard, where it is designated as Annex B. The form follows the standard, and covers
B
the sections which require special attentions. The purpose of the form is to facilitate an agreement
between the machine manufacturer and the control manufacturer. The form is an excellent guide
to cover all aspects of control product used on machinery and eliminate future disagreements.
4.4.3
4.4.4
Description of Standards
■
Not
Applicable Applicable
■
Approved
■
B
in the instruction manual)
Terminal size ■ ■ ■
5.3
5.3.1
Description of Standards
■ ■
■
Approved
Slip-rings ■ ■ ■
Flexible cables ■ ■ ■
5.3.4
5.4
Description of Standards
■ ■
■
Approved
■
B
6 Protection against electric shock 6.2.2 or 6.2.3 ■ ■ ■
6.4
Description of Standards
Protection by PELV
■ ■
■
Approved
7.2.7
7.2.8
Description of Standards
■
Not
Applicable Applicable
■
Approved
■
B
where the conductor is connected to the supply
Availability of fuses ■ ■ ■
8.2.5
Description of Standards
■ ■
■
Approved
9.2.2
9.2.3
Description of Standards
■
Approved
■
B
hazard may result, mode selector with lock ■ ■ ■
may be required
9.2.5.7
Description of Standards
■
Not
Applicable Applicable
■
Approved
■
set time limit
9.3.5
Description of Standards
■
Approved
■
B
9.4 Control functions in the event of failure, ■ ■ ■
see risk assessment
10.2
10.2.1
Description of Standards
Push-buttons
■ ■
■
Approved
10.8.3
Description of Standards
■
Approved
■
B
10.8.4 Actuators red, background yellow, ■ ■ ■
push-button mushroom type
11 Electronic equipment ■ ■ ■
12.2.2
Description of Standards
■ ■
■
Approved
■
circuits, associated control circuits, other
control circuits (external sources, etc.)
14
14.1.1
Description of Standards
Wiring practices
■ ■
■
Approved
■
B
Liquids drain away from flexible wires ■ ■ ■
14.4.1
14.4.2
Description of Standards
■
Not
Applicable Applicable
■
Approved
15
16
Description of Standards
■
Not
Applicable Applicable
■
Approved
■
B
16.1 Socket-outlet per IEC 309-1 or marked with ■ ■ ■
voltage and current
17.4
Description of Standards
Short-circuit rating ■
Not
Applicable Applicable
■ ■
■
Approved
18 Technical documentation ■ ■ ■
18.10
19
Description of Standards
■ ■
■
Approved
■
B
19.1 Product standards apply; if product standard ■ ■ ■
is not available the following tests apply:
128
measures adopted, indicate whether any particular training is required and specify
any need to provide personal protection equipment.
(c) When designing and constructing machinery, and when drafting the instructions, the
manufacturer must envisage not only the normal use of the machinery but also uses
which could reasonably be expected. The machinery must be designed to prevent
abnormal use if such use would engender a risk. In other cases the instructions must
draw the user’s attention to ways — which experience has shown might occur — in
C
which the machinery should not be used.
(d) Under the intended conditions of use, the discomfort, fatigue and psychological stress
faced by the operator must be reduced to the minimum possible taking ergonomic
principles into account.
(e) When designing and constructing machinery, the manufacturer must take into account
the constraints to which the operator is subject as a result of the necessary or
foreseeable use of personal protection equipment (such as footwear, gloves, etc.).
(f) Machinery must be supplied with all the essential special equipment and accessories
to enable it to be adjusted, maintained and used without risk.
1.1.3. Materials and products
1.1.4. Lighting
1.1.5. Design of machinery to facilitate its handling
1.2 Controls: Reliability, starting and stopping, energy isolation, control failures
1.2.1. Safety and reliability of control systems
Control systems must be designed and constructed so that they are safe and reliable,
in a way that will prevent a dangerous situation arising. Above all they must be designed
and constructed in such a way that:
- they can withstand the rigors of normal use and external factors,
- errors in logic do not lead to dangerous situations.
1.2.2. Control devices
Control devices must be:
129
- clearly visible and identifiable and appropriately marked where necessary.
C - positioned for safe operation without hesitation or loss of time, and
without ambiguity,
- designed so that the movement of the control is consistent with its effect,
- located outside the danger zones, except for certain controls where necessary,
such as emergency stop, console for training of robots,
- positioned so that their operation cannot cause additional risk,
- designed or protected so that the desired effect, where a risk is involved, cannot
occur without an intentional operation,
- made so as to withstand foreseeable strain; particular attention must be paid
to emergency stop devices liable to be subjected to considerable strain.
1.2.3. Starting
It must be possible to start machinery only by voluntary actuation of a control provided
for the purpose. The same requirement applies:
- when restarting the machinery after a stoppage, whatever the cause,
- when effecting a significant change in the operating conditions (e.g., speed,
pressure, etc.), unless such restarting or change in operating conditions is without
risk to exposed persons.
Where machinery has several starting controls and the operators can therefore put each
other in danger, additional devices (e.g., enabling devices or selectors allowing only one part
of the starting mechanism to be actuated at any one time) must be fitted to rule out such risks.
1.2.4. Stopping device — Normal stopping
Each machine must be fitted with a control whereby the machine can be brought safely
to a complete stop. Each workstation must be fitted with a control to stop some or all of the
moving parts of the machinery, depending on the type of hazard, so that the machinery is
rendered safe. The machinery’s stop control must have priority over the start controls.
Once the machinery or its dangerous parts have stopped, the energy supply to the actuators
130 concerned must be cut off.
Stopping device — Emergency stop
Each machine must be fitted with one or more emergency stop devices to enable actual
or impending danger to be averted.
The stopping device must:
C
- have clearly identifiable, clearly visible and quickly accessible controls,
- stop the dangerous process as quickly as possible, without creating additional hazards,
- where necessary, trigger or permit the triggering of certain safeguard movements.
The stop command must be sustained by engagement of the emergency stop device until
that engagement is specifically overridden; it must not be possible to engage the device without
triggering a stop command; it must be possible to disengage the device only by an appropriate
operation; and disengaging the device must not restart the machinery but only permit restarting.
1.2.5. Mode selection
1.2.6. Failure of the power supply
The interruption, re-establishment after an interruption or fluctuation in whatever manner
of the power supply to the machinery must not lead to a dangerous situation. In particular:
- the machinery must not start unexpectedly,
- the machinery must not be prevented from stopping if the command has already
been given,
- the protection devices must remain fully effective.
1.2.7 Failure of the control circuit
A fault in the control circuit logic, or failure of or damage to the control circuit must
not lead to dangerous situations. In particular:
- the machinery must not start unexpectedly,
- the machinery must not be prevented from stopping if the command has
already been given,
- no moving part of the machinery or piece held by the machinery must fall or be ejected, 131
C 1.2.8.
- automatic or manual stopping of the moving parts wherever they may be must
be unimpeded,
- the protection devices must remain fully effective.
Software
1.6 Maintenance
1.6.1. Machinery maintenance
It must be possible to carry out adjustment, maintenance, repair, cleaning and servicing
operations while machinery is at a standstill. If one or more of the above conditions cannot
be satisfied for technical reasons, these operations must be possible without risk.
1.6.2. Access to operating position and servicing points
1.6.3. Isolation of energy sources
1.6.4. Operator intervention
1.6.5. Cleaning of internal parts
134
Appendix D — Some significant faults and failures
Electrical/electronic components
- short circuit or open circuit; e.g., each fault (short circuit to the protective conductor
or a conductive part), open circuit of any conductor
D
- short circuit or open circuit occurring in single components; e.g., in position switches,
control and regulation equipment, machine actuators, relay contacts
- non drop-out or non pick-up of electromagnetic elements; e.g., contactors, relays,
magnetic valves
- non-starting or non-stopping of motors; e.g., servo motors
- mechanical blocking of moving elements, loosening or displacing of fixed elements;
e.g., position switches
- drift beyond the tolerance values for analogue elements, e.g. resistors, capacitors,
transistors
- oscillation of (unstable) output signals in integrated components
- loss of entire function or of partial functions (worst-case behavior) in complex integrated
components e.g., microprocessors, programmable electronic systems, application-
specific integrated circuits
Mechanical components
- spring fracture
- stiffness or sticking of guide-moving components
- loosening of fixtures; e.g., by vibration
- wear; e.g., runners, latches, rollers
- misalignment of parts
- environmental influences; e.g., corrosion, temperature
136
Appendix E — Standards and characteristics of safety functions
Reference list of some standards giving requirements for characteristics of safety functions
(as of March 1, 1997)
E
Requirements
Safety Function Additional Information
Characteristic EN EN 292 Further (Not Requirements)
954-1 Standards
Annex A
Part 1 Part 2 Part 2
Definitions 3 3 clause 3 of clause 2 of EN 60335-1
EN 60204-1
Stop function 5.2 3.7.1 1.2.4 9.2.2, 9.2.5.3 7.12 of EN 60335-1 5.11
3.7.8b 1.3.5 of EN 60204-1 of prEN 1921
Emergency stop 5.3 6.1.1 1.2.4 EN 418, 9.2.5.4 6.4.2, 7.2.5 of EN 775,
function of EN 60204-1 5.11.2 of prEN 1921
Manual reset 5.4 6.1.1 1.2.4 EN 418, 9.2.5.4 6.4.2, 6.4.3, 7.6 of EN
of EN 60204-1 775, 6.4.3 of prEN 1921
Start and restart 5.5 3.7.1 1.2.3, 9.2.1, 9.2.5.1, 9.2.5.2, 6.10, 7.2.5, 7.3.1, 9.3.4
3.7.2 1.3.5 9.2.6 of EN 60204-1 of EN 775
Muting 5.9
Manual suspension of 5.10 3.7.10 1.2.5 9.2.4 of EN 60204-1 6.10 of EN 775, 5.8 of
137
safety functions 4.1.4 prEN 1921
E Safety Function
Characteristic
5.11
Part 1 Part 2
3.7.8e
Requirements
EN 292
1.2.6
Annex A
Part 2
Further
Standards
Indications and alarms 3.6.7 1.2.2, ¶ 4, 6 EN 457, prEN 842, 5.6 of prEN 1921
5.3 1.7.0, 1.7.1 prEN 981, 10.4,
11.3 of EN 60204-1,
EN 60447
- the following (parts/clauses of) national technical standards and specifications have been
used (only to be mentioned where appropriate):
(Signature)
(full name and identification of the person empowered to sign on behalf of the manufacturer)
Please note that this declaration must be drawn up in the same language as the original instructions (see Annex I, Section 1.7.4.b)
and must either be typewritten or handwritten in block capitals. It must be accompanied by a translation in one of the official
languages of the country in which the machinery is to be used. This translation must be done in accordance with the same
conditions as for the translation of the instructions.
F DECLARATION BY THE MANUFACTURE (Variant 1)
(Directive 89/392/EEC, Art. 4.2 and Annex II, sub B)
Address:
Herewith declares that
and that
- the following (parts/clauses of) harmonized standards have been applied (only to be
mentioned where appropriate):
- the following (parts/clauses of) national technical standards and specifications have been
used (only to be mentioned where appropriate):
and furthermore declares that it is not allowed to put the machinery into service until the
machinery into which it is to be incorporated or of which it is to be a component has been found
and declared to be in conformity with the provisions of Directive 89/392/EEC and with national
140
implementing legislation, i.e. as a whole, including the machinery referred to in this declaration.
(Signature)
(full name and identification of the person empowered to sign on behalf of the manufacturer)
DECLARATION BY THE MANUFACTURER (variant 2)
(Directive 89/392/EEC, Art. 4.2 and Annex II, sub B)
and that
- the following (parts/clauses of) harmonized standards have been applied (only to be
mentioned where appropriate):
and furthermore declares that it is not allowed to put the machinery into service until the
machinery into which it is to be incorporated or of which it is to be a component has been found
and declared to be in conformity with the provisions of Directive 89/392/EEC and with national
implementing legislation, i.e. as a whole, including the machinery referred to in this declaration.
(Signature) 141
(full name and identification of the person empowered to sign on behalf of the manufacturer)
F EC DECLARATION OF CONFORMITY FOR SAFETY COMPONENTS
Address:
Herewith declares that
which has the following safety function (if not already obvious from the description):
- the following (parts/clauses of) national technical standards and specifications have been
used (only to be mentioned where appropriate):
(full name and identification of the person empowered to sign on behalf of the manufacturer)
Appendix G — Annex IV equipment
The following types of machinery and safety components may require an EC-type
examination:
Machinery
G
1. Circular saws (single or multi-blade) for working with wood and analogous materials
or for working with meat and analogous materials.
A) Sawing machines with fixed tool during operation, having a fixed bed with manual
feed of the workpiece or with a demountable power feed.
B) Sawing machines with fixed tool during operation, having a manually operated
reciprocating saw-bench or carriage.
C) Sawing machines with fixed tool during operation, having a built-in mechanical feed
device for the workpieces, with manual loading and/or unloading.
D) Sawing machines with movable tool during operation, with a mechanical feed device
and manual loading and/or unloading.
2. Hand-fed surface planing machines for woodworking.
3. Thickeners for one-side dressing with manual loading and/or unloading for woodworking.
4. Band-saws with a fixed or mobile bed and band-saws with a mobile carriage, with manual
loading and/or unloading, for working with wood and analogous materials or for working
with meat and analogous materials.
5. Combined machines of the types referred to in 1 to 4 and 7 for working with wood and
analogous materials.
6. Hand-fed tenoning machines with several tool holders for woodworking.
7. Hand-fed vertical spindle moulding machines for working with wood and analogous materials.
8. Portable chain saws for woodworking.
9. Presses, including press-brakes, for the cold working of metals, with manual loading
and/or unloading, whose movable working parts may have a travel exceeding 6 mm and a 143
Safety components
1. Electrosensitive devices designed specifically to detect persons in order to ensure their
safety (non-material barriers, sensor mats, electromagnetic detectors, etc.).
2. Logic units which ensure the safety functions of bi-manual controls.
3. Automatic movable screens to protect the presses referred to in 9, 10, and 11.
4. Roll-over protective structures.
5. Falling-object protective structures.
144
Appendix H — IEC Style Diagrams from Chapter 5
H
Overload
On/Off
pushbutton
K1 M
145
H
E-Stop
Stop
Gate
Interlock
K1
Start
Pusher Controls
K1 M
Overload
Safety
Interlock
Start
K1
K2
Robot Controller
K1 K2 M
Overload
147
Start
K3
K2
K1
K1 K2 K3 M
Overload
Publication SHB-900 — September 1997 © 1997 Allen-Bradley Company, Inc. Printed in USA